CVE-2026-111887

The phpMyFAQ application is vulnerable to account enumeration in versions prior to 4.1.9 and 4.2.0-alpha before 4.2.0-beta . An unauthenticated attacker can submit guest comments to the comment creation endpoint, using candidate usernames and emails to confirm registered account details. The syst...